Linked Questions

28
votes
3answers
7k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
20
votes
3answers
5k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
14
votes
3answers
5k views

How to exchange RSA public keys safely between two parties?

How to exchange RSA public keys safely between two parties via internet?
8
votes
3answers
5k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
6
votes
3answers
220 views

Guarding against rogue certificates

There has been a lot of news recently about certificates being falsely issued (due to the issuing authority having poor system security!). Apparently the targeted users were mostly Iranians, but it's ...
5
votes
3answers
395 views

Why are root certificate authorites allowed to issue certificates for any domain?

Why are certificate authorites allowed to issue certificates trusted by browsers for any domain name? Doesn't that imply that one highjacked root certificate authority can issue trusted fake ...
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
4
votes
3answers
1k views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...
3
votes
3answers
3k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
6
votes
2answers
3k views

With reference to using Gpg4win, which is better: OpenPGP or S/MIME?

Which is better -- OpenPGP or S/MIME for higher security?
4
votes
2answers
106 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
3
votes
2answers
176 views

Can BlackBerry keep us safe from network providers

I recently brought a BlackBerry mobile and the reason I have gone with BB was the security it ensures and now I have a doubt. That said in the Internet, Massage from BBM will first reach Canada via ...
3
votes
2answers
154 views

Is it possible to use an open collection of default SSL certificates for my browser?

Browsers and Operating Systems come with a set of default SSL certificates for well known organizations, such as root certificates from CAs. I understand that the trust model is as follows: I pick (...
14
votes
1answer
3k views

Is it safe to let apt-get applications install root certificates?

I've recently installed Pinta, a program for drawing and image editing, and as part of the installation it installed 173 root certificates (see below). Is it normal practice to do so? Why does it ...
6
votes
1answer
168 views

Are there “master keys” that can be used to generate valid SSL keys?

I was in a discussion about SSL, and I was explaining that it's impossible to decrypt data sent over SSL if you don't have the key. Someone responded with the following, that really confused me: ...

15 30 50 per page